[42lizard]

Summary

Header Menu clicks could bypass the restrictions applied to the hardware Menu key. Both now share one eligibility rule. Native reading-position reads own their consistency, and book actions own their presentation roles.

Header + hardware Menu → shared activation guard
Sync / Open / Upload → native read-only transaction
Book state → book actions → details + decision dialog

The native read no longer needs an application-owned database copy. The book-action module preserves existing labels, order and authorization while removing command-name interpretation from QML.

Evidence

• Before: Header Menu called the page directly; only the hardware path checked busy, decision and blocking states.
  After: Paired header/hardware UI checks pass for each guard and the available state.
• Before: Position capture required temporary naming, a full database backup and cleanup in the application.
  After: Native position tests verify read-only WAL access and a writer committing between identity and settings queries: the current read retains its snapshot, and the next read sees the new position.
• Before: QML inferred primary, secondary, menu and decision roles from command strings and ordering.
  After: Shared action tests cover local-copy choices, pending upload, conflicts, blocking states, cover-menu placement and signed-out behavior; existing UI and authorization checks pass.
• Complete simulator CTest suite: 18/18 passed. After the additional test-only commit, the probe suite passed again (25 checks).
• PocketBook ARM build, loader, resource format and ABI checks passed.
• Standards and spec reviews: no open findings.
• Device validation exposed a pre-existing activation latch: tapping a book during refresh set the duplicate-tap guard before the controller rejected the request. Busy taps now return before setting the guard. The Qt UI regression exercises real row taps during and after refresh and passes; the rebuilt ARM binary passed ABI checks.
• The user confirmed the combined device test passed after installing commit 7a8d9fc, including the tap fix. Installed app SHA-256: e31366d6861597141f71fc66b1506d8d76c5834c1b73473d097a580c08cf014f. The installer verified native databases remained unchanged.

Merge Danger

Door: two-way

No schema migration or native write changes. Revertible implementation changes.

Blast Radius: interaction

Menu activation, book action rendering, and native position reads during Sync/Open/Upload. The combined build has passed the agreed device check.